{"id":"GHSA-xg2q-4rrq-657q","kind":"vulnerability","aliases":["GHSA-xg2q-4rrq-657q"],"related":[],"title":"The \"private_ranges\" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies","description":"### Description\r\n\r\n`framework.trusted_proxies: private_ranges`, which the deployment documentation recommends, and the `private_ranges` and `PRIVATE_SUBNETS` keywords of `Request::setTrustedProxies()` resolved to `IpUtils::PRIVATE_SUBNETS`. That constant is the deny list of `NoPrivateNetworkHttpClient`: it lists the private and special-purpose prefixes a server must not connect to, and since the fix for CVE-2026-48736 it also covers the IPv6 prefixes that embed an IPv4 address: IPv4-mapped (`::ffff:0:0/96`), IPv4-compatible (`::/96`), 6to4 (`2002::/16`), Teredo (`2001::/32`) and NAT64 (`64:ff9b::/96`). Over-blocking is safe for a deny list. Used as the allow list of trusted proxies, the same entries trust remote clients.\r\n\r\nA client whose connection arrives with such a source address was treated as a reverse proxy, and the `X-Forwarded-For`, `X-Forwarded-Host`, `X-Forwarded-Proto`, `X-Forwarded-Port` and `X-Forwarded-Prefix` headers it sends were honoured:\r\n\r\n```php\r\nRequest::setTrustedProxies(['private_ranges'], Request::HEADER_X_FORWARDED_FOR | Request::HEADER_X_FORWARDED_HOST | Request::HEADER_X_FORWARDED_PROTO);\r\n\r\n$request = Request::create('/reset-password');\r\n$request->server->set('REMOTE_ADDR', '::ffff:203.0.113.7');\r\n$request->headers->set('X-Forwarded-For', '10.0.0.9');\r\n$request->headers->set('X-Forwarded-Host', 'evil.example.com');\r\n$request->headers->set('X-Forwarded-Proto', 'https');\r\n\r\n$request->getClientIp(); // 10.0.0.9\r\n$request->getHost();     // evil.example.com\r\n$request->isSecure();    // true\r\n```\r\n\r\nTwo kinds of deployments are exposed. A server listening on the IPv6 wildcard address without `IPV6_V6ONLY` reports every IPv4 client in the IPv4-mapped form, so every client is trusted. A server reachable over IPv6 trusts any client sourcing from 6to4 or Teredo space, which is globally routed, whatever its listener. A spoofed client address defeats IP allow lists, rate limiting and audit logs; a spoofed host poisons the URLs written into password reset and login link e-mails and into shared caches; a spoofed scheme satisfies `requires_channel: https` over plain HTTP.\r\n\r\nThe IPv4-mapped entry has been in the list since the `private_ranges` shortcut was introduced, in 7.1 for `framework.trusted_proxies` and in 7.2 for `Request::setTrustedProxies()`; the other prefixes joined it in 7.4.13 and 8.0.13.\r\n\r\nSymfony 6.4 does not point any trusted proxy setting at `IpUtils::PRIVATE_SUBNETS`, so it is not affected by default. An application that passes that constant to `Request::setTrustedProxies()` itself is exposed the same way on any version. It should pass `IpUtils::PRIVATE_RANGES` instead, which 6.4.50 provides too.\r\n\r\n### Resolution\r\n\r\nTrusted proxies get their own list. `IpUtils::PRIVATE_RANGES` holds the ranges reserved for private networks, in which a reverse proxy can live: loopback, RFC 1918, shared address space (RFC 6598), link-local and unique local addresses. It contains no prefix a remote client can present as its own address, and `private_ranges` and `PRIVATE_SUBNETS` now resolve to it. `IpUtils::PRIVATE_SUBNETS` is unchanged and remains the deny list of `NoPrivateNetworkHttpClient`.\r\n\r\n`IpUtils::checkIp()` now judges an IPv4-mapped address as the IPv4 host it embeds, so a proxy that a dual-stack listener reports as `::ffff:10.0.0.5` is still trusted through `10.0.0.0/8`, and an IPv4 range configured explicitly in `trusted_proxies` or in `access_control.ips` matches the clients that reach a dual-stack listener as well.\r\n\r\nTwo behaviour changes for operators: the documentation, benchmarking, \"this network\" and reserved ranges the old list covered (`192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`, `198.18.0.0/15`, `0.0.0.0/8`, `240.0.0.0/4`, `2001:db8::/32`, `2001:2::/48`) are no longer trusted by the shortcut and have to be listed explicitly when a proxy lives there; and applications that pass `IpUtils::PRIVATE_SUBNETS` to `Request::setTrustedProxies()` themselves should pass `IpUtils::PRIVATE_RANGES` instead.\r\n\r\nThe patches for this issue are available [here](https://github.com/symfony/symfony/commit/e109aa54d42678e2a72ec148092a8453a67de931) for branch 7.4 (and forward-ported to 8.1 and 8.2). `IpUtils::PRIVATE_RANGES` is available [here](https://github.com/symfony/symfony/commit/7cf9fb3240df4149ad8a968888eab29426b6fcb8) for branch 6.4.\r\n\r\n### Credits\r\n\r\nWe would like to thank Ivan Tse for reporting the issue and Nicolas Grekas for providing the fix.","summary":"Symfony's private_ranges trusted-proxies setting also matches IPv6 addresses that embed IPv4 (IPv4-mapped, 6to4, Teredo, NAT64), so any client sending those addresses is treated as a reverse proxy. An attacker can then spoof the client IP, host and scheme through X-Forwarded-* headers.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"symfony/http-foundation","note":">=7.2, <7.4.23","fixed":["7.4.23"],"affected":">= 7.2, < 7.4.23","ecosystem":"composer"},{"name":"symfony/http-foundation","note":">=8, <8.1.11","fixed":["8.1.11"],"affected":">= 8, < 8.1.11","ecosystem":"composer"},{"name":"symfony/framework-bundle","note":">=7.1, <7.4.23","fixed":["7.4.23"],"affected":">= 7.1, < 7.4.23","ecosystem":"composer"},{"name":"symfony/framework-bundle","note":">=8, <8.1.11","fixed":["8.1.11"],"affected":">= 8, < 8.1.11","ecosystem":"composer"},{"name":"symfony/symfony","note":">=7.1, <7.4.23","fixed":["7.4.23"],"affected":">= 7.1, < 7.4.23","ecosystem":"composer"},{"name":"symfony/symfony","note":">=8, <8.1.11","fixed":["8.1.11"],"affected":">= 8, < 8.1.11","ecosystem":"composer"}],"ecosystems":["composer"],"tags":["cwe-290","cwe-348","ipv6","package","php","self-hosted","symfony"],"not_affected_if":["default-config","explicit-trusted-proxies","symfony-6.4"],"how_to_check":"- Check the Symfony version in `composer.lock` for `symfony/http-foundation`, `symfony/framework-bundle` or `symfony/symfony`.\n- Search `config/packages/framework.yaml` for `trusted_proxies: private_ranges` or `Request::setTrustedProxies` calls using `IpUtils::PRIVATE_SUBNETS` or the `private_ranges` / `PRIVATE_SUBNETS` keywords.\n- Check whether the app listens on the IPv6 wildcard address without `IPV6_V6ONLY`, or is reachable over IPv6.","fix":"- `symfony/http-foundation` and `symfony/framework-bundle` and `symfony/symfony` on 7.4 branch: `7.4.23`\n- `symfony/http-foundation` and `symfony/framework-bundle` and `symfony/symfony` on 8.x branch: `8.1.11`\n- Symfony 6.4: `6.4.50` provides `IpUtils::PRIVATE_RANGES`; applications passing `IpUtils::PRIVATE_SUBNETS` to `Request::setTrustedProxies()` should switch to `IpUtils::PRIVATE_RANGES`.","status":"open","published_at":"2026-11-04T11:43:46+00:00","first_seen_at":"2026-11-09T22:53:31+00:00","triaged_at":"2026-11-09T22:54:48+00:00","updated_at":"2026-11-09T22:54:48+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-09T22:54:48Z","model":"claude-haiku-5-5","output":{"fix":"- `symfony/http-foundation` and `symfony/framework-bundle` and `symfony/symfony` on 7.4 branch: `7.4.23`\n- `symfony/http-foundation` and `symfony/framework-bundle` and `symfony/symfony` on 8.x branch: `8.1.11`\n- Symfony 6.4: `6.4.50` provides `IpUtils::PRIVATE_RANGES`; applications passing `IpUtils::PRIVATE_SUBNETS` to `Request::setTrustedProxies()` should switch to `IpUtils::PRIVATE_RANGES`.","reach":"internet","title":"Symfony: trusted-proxies shortcut lets remote clients spoof IP, host and scheme","impact":"medium","summary":"Symfony's private_ranges trusted-proxies setting also matches IPv6 addresses that embed IPv4 (IPv4-mapped, 6to4, Teredo, NAT64), so any client sending those addresses is treated as a reverse proxy. An attacker can then spoof the client IP, host and scheme through X-Forwarded-* headers.","audience":"developers","category":"package","nicknames":[],"who_cares":["symfony","php","self-hosted","ipv6"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker spoofs client IP, host and scheme, poisoning reset links","analyst_note":"","how_to_check":"- Check the Symfony version in `composer.lock` for `symfony/http-foundation`, `symfony/framework-bundle` or `symfony/symfony`.\n- Search `config/packages/framework.yaml` for `trusted_proxies: private_ranges` or `Request::setTrustedProxies` calls using `IpUtils::PRIVATE_SUBNETS` or the `private_ranges` / `PRIVATE_SUBNETS` keywords.\n- Check whether the app listens on the IPv6 wildcard address without `IPV6_V6ONLY`, or is reachable over IPv6.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","explicit-trusted-proxies","symfony-6.4"],"who_is_affected":"Applications on Symfony 7.1 to 7.4.22 or 8.0 to 8.1.10 that trust proxies with the private_ranges setting or pass IpUtils::PRIVATE_SUBNETS to Request::setTrustedProxies(). Exposure is greatest on servers listening on the IPv6 wildcard without IPV6_V6ONLY, or reachable over IPv6. Symfony 6.4 is not affected by default, and apps that use an explicit list of trusted proxies are not affected by this shortcut.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.001167,"input_tokens":6675,"output_tokens":998,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':153C '-290':39B '-348':41B '-48736':154C '/15':656C '/16':178C '/24':650C,652C,654C '/32':181C,663C '/4':660C '/48':666C '/8':607C,658C '/96':175C,186C '/reset-password':277C '0':170C '0.0.0.0':657C '0/96':171C '10.0.0.0':606C '10.0.0.5':601C '10.0.0.9':292C,311C '1918':526C '192.0.2.0':649C '198.18.0.0':655C '198.51.100.0':651C '2':665C '2001':180C,661C,664C '2002':177C '203.0.113.0':653C '203.0.113.7':284C '240.0.0.0':659C '4rrq':25A,30A '6.4':452C '6.4.50':497C '64':184C '657q':26A,31A '6598':531C '6to4':14A,67B,176C,360C '7.1':432C '7.2':438C '7.4.13':448C '8.0.13':450C 'access_control.ips':619C 'addr':282C 'address':18A,60B,75B,165C,219C,331C,374C,528C,538C,551C,582C 'affect':468C 'allow':199C,377C 'also':57B,156C 'applic':472C,686C 'arriv':214C 'attack':83B 'audit':382C 'behaviour':633C 'benchmark':639C 'block':189C 'cach':403C 'chang':634C 'channel':409C 'checkip':575C 'client':8A,72B,88B,209C,211C,338C,347C,357C,373C,545C,622C 'compat':174C 'configur':612C 'connect':145C,213C 'constant':125C,476C 'contain':540C 'cover':157C,648C 'creat':276C 'cve':152C 'cwe':38B,40B 'db8':662C 'default':470C 'defeat':375C 'deni':128C,194C,570C 'deploy':105C,321C 'descript':98C 'document':106C,638C 'dual':595C,627C 'dual-stack':594C,626C 'e':398C 'e-mail':397C 'emb':62B,162C,588C 'entri':206C,418C 'everi':336C,346C 'evil.example.com':300C,314C 'explicit':613C,679C 'expos':323C,482C 'ff9b':185C 'ffff':169C,283C,600C 'fix':150C 'form':344C 'forward':96B,230C,234C,238C,242C,247C,262C,267C,272C,290C,298C,306C 'framework.trusted':99C,434C 'get':503C 'getclientip':310C 'gethost':313C 'ghsa':23A,28A 'ghsa-xg2q-4rrq-657q':22A,27A 'global':366C 'header':97B,249C,260C,265C,270C,286C,294C,302C 'hold':510C 'honour':253C 'host':47B,90B,235C,268C,299C,386C,586C 'http':413C 'https':308C,410C 'instead':495C 'introduc':430C 'ip':89B,376C 'iputil':121C,461C,492C,507C,562C,574C,689C,698C 'ipv4':12A,63B,65B,164C,167C,173C,337C,342C,416C,580C,585C,610C 'ipv4-compatible':172C 'ipv4-mapped':11A,64B,166C,341C,415C,579C 'ipv6':42B,59B,159C,329C,333C,354C 'issecur':316C 'join':445C 'judg':577C 'keyword':115C 'kind':319C 'limit':380C 'link':396C,533C 'link-loc':532C 'list':129C,133C,195C,200C,378C,423C,506C,571C,647C,678C 'listen':326C,370C,597C,629C 'live':523C,683C 'local':534C,537C 'log':383C 'login':395C 'longer':669C 'loopback':524C 'mail':399C 'map':13A,66B,168C,343C,417C,581C 'match':58B,620C 'must':143C 'nat64':17A,69B,183C 'network':516C,641C 'noprivatenetworkhttpcli':131C,573C 'old':646C 'oper':636C 'over-block':187C 'packag':43B 'pass':474C,491C,688C,697C 'password':392C 'php':44B,254C 'plain':412C 'point':455C 'poison':387C 'port':243C 'prefix':140C,160C,248C,444C,542C 'present':9A,547C 'privat':2A,51B,101C,110C,113C,122C,135C,257C,426C,462C,493C,508C,515C,553C,556C,563C,690C,699C 'proto':239C,273C,307C 'provid':498C 'proxi':5A,21A,55B,81B,100C,203C,225C,435C,458C,502C,521C,591C,616C,682C 'purpos':139C 'rang':3A,52B,102C,111C,258C,427C,494C,509C,512C,554C,611C,644C,700C 'rate':379C 'reach':624C 'reachabl':352C 'recommend':107C 'remain':568C 'remot':208C,281C,544C 'report':335C,598C 'request':117C,255C,259C,264C,269C,274C,275C,278C,285C,293C,301C,309C,312C,315C,440C,478C,693C 'requir':408C 'reserv':513C,643C 'reset':393C 'resolut':500C 'resolv':119C,559C 'revers':20A,80B,224C,520C 'rfc':525C,530C 'rout':367C 'safe':191C 'satisfi':407C 'scheme':92B,406C 'self':46B 'self-host':45B 'send':73B,251C 'server':142C,279C,325C,351C 'set':56B,280C,287C,295C,303C,459C 'settrustedproxi':118C,256C,441C,479C,694C 'share':402C,527C 'shortcut':6A,428C,673C 'sinc':148C,424C 'sourc':218C,358C 'space':363C,529C 'special':138C 'special-purpos':137C 'spoof':86B,372C,385C,405C 'stack':596C,628C 'still':603C 'subnet':114C,123C,463C,557C,564C,691C 'symfoni':48B,49B,451C 'symfony/framework-bundle':34A,35A 'symfony/http-foundation':32A,33A 'symfony/symfony':36A,37A 'teredo':15A,68B,179C,362C 'treat':77B,221C 'true':317C 'trust':4A,7A,54B,202C,207C,349C,355C,457C,501C,604C,615C,670C 'trusted-proxi':53B 'two':318C,632C 'unchang':566C 'uniqu':536C 'url':389C 'use':196C 'v6only':334C 'version':488C 'way':485C 'well':631C 'whatev':368C 'whose':212C 'wildcard':330C 'without':332C 'written':390C 'x':95B,229C,233C,237C,241C,246C,261C,266C,271C,289C,297C,305C 'x-forward':94B 'x-forwarded-for':228C,288C 'x-forwarded-host':232C,296C 'x-forwarded-port':240C 'x-forwarded-prefix':245C 'x-forwarded-proto':236C,304C 'xg2q':24A,29A","nicknames":[],"mitigations":[],"who_affected":"Applications on Symfony 7.1 to 7.4.22 or 8.0 to 8.1.10 that trust proxies with the private_ranges setting or pass IpUtils::PRIVATE_SUBNETS to Request::setTrustedProxies(). Exposure is greatest on servers listening on the IPv6 wildcard without IPV6_V6ONLY, or reachable over IPv6. Symfony 6.4 is not affected by default, and apps that use an explicit list of trusted proxies are not affected by this shortcut.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["symfonyframeworkbundle","symfonyhttpfoundation","symfonysymfony"],"ptokens":["bundle","foundation","framework","http","symfony"],"labels":["composer","cwe290","cwe348","ipv6","medium","package","php","selfhosted","symfony"],"campaign_type":null,"search_a":"'4rrq':25A,30A '657q':26A,31A '6to4':14A 'address':18A 'client':8A 'ghsa':23A,28A 'ghsa-xg2q-4rrq-657q':22A,27A 'ipv4':12A 'ipv4-mapped':11A 'map':13A 'nat64':17A 'present':9A 'privat':2A 'proxi':5A,21A 'rang':3A 'revers':20A 'shortcut':6A 'symfony/framework-bundle':34A,35A 'symfony/http-foundation':32A,33A 'symfony/symfony':36A,37A 'teredo':15A 'trust':4A,7A 'xg2q':24A,29A","search_b":"'-290':39B '-348':41B '6to4':67B 'address':60B,75B 'also':57B 'attack':83B 'client':72B,88B 'cwe':38B,40B 'emb':62B 'forward':96B 'header':97B 'host':47B,90B 'ip':89B 'ipv4':63B,65B 'ipv4-mapped':64B 'ipv6':42B,59B 'map':66B 'match':58B 'nat64':69B 'packag':43B 'php':44B 'privat':51B 'proxi':55B,81B 'rang':52B 'revers':80B 'scheme':92B 'self':46B 'self-host':45B 'send':73B 'set':56B 'spoof':86B 'symfoni':48B,49B 'teredo':68B 'treat':77B 'trust':54B 'trusted-proxi':53B 'x':95B 'x-forward':94B","search_c":"'-2026':153C '-48736':154C '/15':656C '/16':178C '/24':650C,652C,654C '/32':181C,663C '/4':660C '/48':666C '/8':607C,658C '/96':175C,186C '/reset-password':277C '0':170C '0.0.0.0':657C '0/96':171C '10.0.0.0':606C '10.0.0.5':601C '10.0.0.9':292C,311C '1918':526C '192.0.2.0':649C '198.18.0.0':655C '198.51.100.0':651C '2':665C '2001':180C,661C,664C '2002':177C '203.0.113.0':653C '203.0.113.7':284C '240.0.0.0':659C '6.4':452C '6.4.50':497C '64':184C '6598':531C '6to4':176C,360C '7.1':432C '7.2':438C '7.4.13':448C '8.0.13':450C 'access_control.ips':619C 'addr':282C 'address':165C,219C,331C,374C,528C,538C,551C,582C 'affect':468C 'allow':199C,377C 'also':156C 'applic':472C,686C 'arriv':214C 'audit':382C 'behaviour':633C 'benchmark':639C 'block':189C 'cach':403C 'chang':634C 'channel':409C 'checkip':575C 'client':209C,211C,338C,347C,357C,373C,545C,622C 'compat':174C 'configur':612C 'connect':145C,213C 'constant':125C,476C 'contain':540C 'cover':157C,648C 'creat':276C 'cve':152C 'db8':662C 'default':470C 'defeat':375C 'deni':128C,194C,570C 'deploy':105C,321C 'descript':98C 'document':106C,638C 'dual':595C,627C 'dual-stack':594C,626C 'e':398C 'e-mail':397C 'emb':162C,588C 'entri':206C,418C 'everi':336C,346C 'evil.example.com':300C,314C 'explicit':613C,679C 'expos':323C,482C 'ff9b':185C 'ffff':169C,283C,600C 'fix':150C 'form':344C 'forward':230C,234C,238C,242C,247C,262C,267C,272C,290C,298C,306C 'framework.trusted':99C,434C 'get':503C 'getclientip':310C 'gethost':313C 'global':366C 'header':249C,260C,265C,270C,286C,294C,302C 'hold':510C 'honour':253C 'host':235C,268C,299C,386C,586C 'http':413C 'https':308C,410C 'instead':495C 'introduc':430C 'ip':376C 'iputil':121C,461C,492C,507C,562C,574C,689C,698C 'ipv4':164C,167C,173C,337C,342C,416C,580C,585C,610C 'ipv4-compatible':172C 'ipv4-mapped':166C,341C,415C,579C 'ipv6':159C,329C,333C,354C 'issecur':316C 'join':445C 'judg':577C 'keyword':115C 'kind':319C 'limit':380C 'link':396C,533C 'link-loc':532C 'list':129C,133C,195C,200C,378C,423C,506C,571C,647C,678C 'listen':326C,370C,597C,629C 'live':523C,683C 'local':534C,537C 'log':383C 'login':395C 'longer':669C 'loopback':524C 'mail':399C 'map':168C,343C,417C,581C 'match':620C 'must':143C 'nat64':183C 'network':516C,641C 'noprivatenetworkhttpcli':131C,573C 'old':646C 'oper':636C 'over-block':187C 'pass':474C,491C,688C,697C 'password':392C 'php':254C 'plain':412C 'point':455C 'poison':387C 'port':243C 'prefix':140C,160C,248C,444C,542C 'present':547C 'privat':101C,110C,113C,122C,135C,257C,426C,462C,493C,508C,515C,553C,556C,563C,690C,699C 'proto':239C,273C,307C 'provid':498C 'proxi':100C,203C,225C,435C,458C,502C,521C,591C,616C,682C 'purpos':139C 'rang':102C,111C,258C,427C,494C,509C,512C,554C,611C,644C,700C 'rate':379C 'reach':624C 'reachabl':352C 'recommend':107C 'remain':568C 'remot':208C,281C,544C 'report':335C,598C 'request':117C,255C,259C,264C,269C,274C,275C,278C,285C,293C,301C,309C,312C,315C,440C,478C,693C 'requir':408C 'reserv':513C,643C 'reset':393C 'resolut':500C 'resolv':119C,559C 'revers':224C,520C 'rfc':525C,530C 'rout':367C 'safe':191C 'satisfi':407C 'scheme':406C 'send':251C 'server':142C,279C,325C,351C 'set':280C,287C,295C,303C,459C 'settrustedproxi':118C,256C,441C,479C,694C 'share':402C,527C 'shortcut':428C,673C 'sinc':148C,424C 'sourc':218C,358C 'space':363C,529C 'special':138C 'special-purpos':137C 'spoof':372C,385C,405C 'stack':596C,628C 'still':603C 'subnet':114C,123C,463C,557C,564C,691C 'symfoni':451C 'teredo':179C,362C 'treat':221C 'true':317C 'trust':202C,207C,349C,355C,457C,501C,604C,615C,670C 'two':318C,632C 'unchang':566C 'uniqu':536C 'url':389C 'use':196C 'v6only':334C 'version':488C 'way':485C 'well':631C 'whatev':368C 'whose':212C 'wildcard':330C 'without':332C 'written':390C 'x':229C,233C,237C,241C,246C,261C,266C,271C,289C,297C,305C 'x-forwarded-for':228C,288C 'x-forwarded-host':232C,296C 'x-forwarded-port':240C 'x-forwarded-prefix':245C 'x-forwarded-proto':236C,304C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-04T11:43:46+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-xg2q-4rrq-657q","url":"https://github.com/symfony/symfony/security/advisories/GHSA-xg2q-4rrq-657q","severity":"medium","published_at":"2026-11-04T11:43:46+00:00","modified_at":"2026-11-06T14:55:39+00:00","first_seen_at":"2026-11-09T22:53:31+00:00","fetched_at":"2026-11-09T22:53:31+00:00","note":null}],"documents":[{"id":110700,"url":"https://github.com/symfony/symfony/security/advisories/GHSA-xg2q-4rrq-657q","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}